CVE-2026-46827: Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Self Service Manager)

Synopsis

This is a high-severity vulnerability in the Self Service Manager component of Oracle Payroll, part of Oracle E-Business Suite versions 12.2.3 through 12.2.15. The flaw is reachable over the network via HTTP and requires only a low-privileged account, with no victim interaction needed. Successful exploitation gives an attacker full takeover of Oracle Payroll, affecting confidentiality, integrity, and availability. No fix version has been published yet; HarborGuard is tracking the advisory and will make a patched-image rebuild available as soon as Oracle releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle Payroll service over the network via HTTP; no local or physical access is needed.

• AuthenticationRequired

  A low-privilege account is sufficient; any authenticated user with basic network access can attempt the exploit.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker operates independently once authenticated.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions or environmental prerequisites.

Blast Radius

• A successful attacker reads all payroll data stored in the affected Oracle E-Business Suite instance, including salary, tax, and personal employee records.
• The attacker can modify persisted payroll records, altering compensation figures, payment details, or tax configurations.
• The attacker can crash or render the Oracle Payroll service unavailable, disrupting payroll processing for the organization.
• Full application takeover means the attacker can also pivot to other components of the E-Business Suite accessible from the compromised Payroll context.